X_CLI_OUTBOUND_UNDECLARED

a non-test packages/cli/src file spells a host not on the allowlist

x sends nothing anywhere, and a host literal nobody wrote a reason for is how telemetry or an update check arrives. Every scheme://host in a string literal is read (comments are not); names no machine answers for are exempt — .invalid, .test, .example, example.com/.net/.org, localhost, loopback

delete the URL (an example takes app.example.com), or add a row with its why to CLI_OUTBOUND_ALLOWLIST in scripts/cli-outbound.ts, then bun run scripts/cli-outbound.ts --json